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(54) Systems and method for policy based printing and forgery detection 


(57) A print nnanagennent system includes a policy 
(113) that detennines a protection level for a docunnent 
to be printed. The document is printed using forgery de- 
tection and deterrence technologies, such as fragile and 
robust watermarks, glyphs, and digital signatures, that 
are appropriate to the level of protection determined by 
the policy. A plurality of printers (130) are managed by 
a print management system (112). Each printer (130) 
can provide a range of protection technologies. The pol- 
icy detemnines the protection technologies for the doc- 
ument to be printed. The print management system 
(112) routes the print job to a printer (1 30) that can apply 
the appropriate protections and sets the appropriate pa- 
rameters in the printer. Copy evidence that can establish 
that a document is a forgery and/or tracing information 
that identifies the custodian of the document and restric- 
tions on copying of the document and use of the infor- 
mation in the document are included in the watermark 
that is printed on the document. A document can be ver- 
ified as an original or established as a forgery by inspect- 
ing the copy evidence and/or tracing information in the 
watermark. 
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[0001] This invention relates to document forgery protection systems and methods. 

[0002] Various techniques are known for detecting and/or deterring forgery of an original printed document Document 
forgery includes both unauthorized alteration of the original document and unauthorized copying of the original docu- 
ment. Previously, watemnarks have been applied to documents to detect and/or deter forgery. Watemiarks are printed 
marks on a document that can be visually detected or detected using special equipment. Fragile watermarks are marks 
that appear in an onginal printed document but that will not appear in a copy of the original document made on a 
standard photocopier or will be detectably degraded in the resulting copy of the document. 

[0003] Robust watermarks are marks in an original document that will be accurately reproduced on any copy of the 
original document made on an standard photocopier so that information contained in the watermark can be extracted 
from the copy. There are two types of robust watemnarks that can be used. The first type of robust watermark is a mark 
that appears on both the original document and a copy. The second type of robust watermark is a mark that is present 
but that IS not readily visible, on the original document, but that becomes clearly visible on a copy of the original 
document. The second type of robust watermark is also known as an invisible robust watemiark. 
[0004] Forgery of an original document containing a fragile watemnark by copying the original document is easily 
detected by the absence of the watemiark on the copy of the original document. Forgery of an original document 
containing the first type of robust watermark is detected by extracting information contained in the robust mark 
[0005] This infomnation could identify a custodian of the original document and information relating to copy restrictions 
or other restrictions as to the use of the infomiation in the original document. Forgery of an original document containing 
the second type of robust watemiark is detected by the visible presence of the watermark on the copy of the original 
document. For example, the information contained in the second type of robust watermark could be a banner that 
reads "This is a copy" or a similar warning. 

[0006] This invention provides systems and methods for adding fragile and robust watermarks to an original docu- 
ment as it is printed. 

[0007] This invention separately provides systems and methods for printing a document requiring forgery protection 
using a number of trusted printers. y y 

[0008] This invention separately provides a series of trusted printers that together permit differing levels of forqerv 
protection to be provided to a document to be printed. 

[0009] In accordance with various exemplary embodiments of the systems and methods according to this invention 
a family of trusted printers is managed to provide a range of different forgery detection and deterrence techniques' 
The protection requirements for an original document to be printed are determined by a trusted printing policy The 
factors used to determine the protection requirements required for the original document to be printed include the value 
of the document being created, assumptions about the resources available to an adversary or attacker, such as a 
potential forger, and the cost of providing the protections to the original document to be printed. 
[0010] When an original document requiring forgery protection is to be printed, the print job for that document is 
routed to a trusted printer that can print a wateimark that includes copy evidence and/or tracing infomiation necessary 
to obtain the required level of protection. Copy evidence is evidence that can be obtained through an inspection of a 
document that indicates whether that particular document is an unauthorized copy of an original document Tracing 
information is information printed on a document that identifies the custodian(s) of the original document and restrictions 
on further copying that apply to the custodian(s) and to the original document. Other information may also be included 
in the tracing information that serves to more uniquely identify the original. The required copy evidence is applied to 
the pnnted document through the use of fragile watermarks or robust watermarks. The required tracing information is 
applied to the printed document through the use of robust watemiarks. The parameters of the selected trusted printer 
are set by a print management system to print the watemiark(s), including the copy evidence and/or tracing information 
appropriate to the required level of protection. 

[0011] These and other features of the invention will be described in or are apparent from the following detailed 
description of various exemplary embodiments of systems and methods according to this invention. 
[0012] Particular embodiments in accordance with this invention will now be described with reference to the accom- 
panying drawings; in which:- 

Fig. 1 is a schematic diagram illustrating a print management system according to this invention; 

Fig. 2 is a flowchart of a document forgery protection printing method according to an exemplary embodiment of 

this invention; 

Fig. 3 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; 

Fig. 4 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; 


2 


EP 1 209 897 A2 

Fig. 5 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; 

Fig. 6 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; 

5 Fig. 7 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 

embodiment of this invention; 

Fig. 8 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention; . 
Fig. 1 0 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
10 embodimentof this invention; and 

Fig. 1 1 is a flow diagram of a document forgery protection printing and detection system according to an exemplary 
embodiment of this invention . 

r00131 Fiq 1 is a schematic diagram illustrating a system for policy based printing. A networi< 100 includes at least 
15 one server 110 that controls a plurality of computers 121, 122 and 23, The server 110 also controls a fan^ilv 13° °' 
trusted printers 131-135. A trusted printer is a printer that is available only to authorized users of the network 100. The 
server 110 includes an operating system 111 that allows users of the network 100 to use various applications stored 
in the server 110 on the computers 121, 122 and 123. The applications may include, for example, word processing 
applications, spreadsheet applications, image scanning and/or processing applications, and/or database management 
20 applications. Authorized users of the computers 121 . 1 22 and 23 can use the applications stored in the server 110 and 
controlled by the operating system 111 to create documents 140. The applications process images of the document 
140 that can be viewed on the display units 151 , 152 and 153 of the respective computers 121 , 122 and 123. 
[0014] The document 140 can be printed by entering a print command into one of the computers 121 or 122 or 123 
and sending a print job to the server 110. The operating system 111 includes a print management system 112 that 
25 selects one of the family 130 of the trusted printers 131-135 that can provide a required level of protection for the 
document140tobeprinted.Theprintmanagementsystem112includesapolicy113thatmapsthedocument protection 

requirements to the specific security protection techniques available from the family 1 30 of the trusted pnnters 1 31 -1 35. 
[00151 The policy 113 determines the required protection level for the document 140 to be printed by collecting 
information about the value of the document 140 from the document creator or owner or from any other person au- 

30 thorized to print the document 1 40. The information may include assumptions about potential forgery and the cost 
necessary to provide a level of protection to detect and/or deter the potential forgery. The user may enterthe infomiation 
about the document 1 40 through a graphical user interface provided on one of the display units 1 51 -1 53 of the particular 
computers 1 21 -1 23 being used to print the document 1 40. ^ » ^ i oc 

[0016] The print management system 112 may also allow the users to question each of the trusted printers 131-135 

35 to determine what protection level each trusted printer 131 -135 provides. The print management system 11 2 may also 
provide information to the user about which forgery techniques each protection level is able to detect and/or deter and 
the costs of using each protection level. Each computer 121 -1 23 may be controlled by the print management systern 
1 1 2 and/or the operating system 1 1 1 to display to users the protection levels that may be applied to the document 1 40 

40 [OOnr'^Each document 1 40 lo be printed may also have a security level embedded in it. attached to it or othenwise 
associated with it, that the print management system 112 can use to identify the specific combination of protection 
techniques needed to detect and/or deter potential forgery. The policy 113 is programmable and may be adapted to 
the particular requirements of the organization that operates, owns or uses the network 100. The policy 113 may be 
programmed to assign a protection level or levels for every authorized user of the network 100 or for every computer 

45 121-123 of the network 100. _. . . i- xh^ iri^n., 

[00181 Every user of the network 100 may have an identification that is programmed into the policy 113. The identi- 
fication may be a login password or user identification. Every document 140 printed by the user identified by the iden- 
tification may have be assigned a specified protection level, a minimum protection level and/or a maximum protection 

50 m0191 Every computer 121-123 of the network 100 may have an identification value. The computer identification 
values may be programmed into the policy 113. Every print job sent by the identified one of the computers 121-123 to 
the server 110 may have a specified protection level, a minimum protection level and/or a maximum protection level. 
The policy 113 determines the protection requirements for the document 140 to be printed by identifying the user that 
enterstheprintcommandand/orthecomputer121-123thatsendstheprintjob. 

55 [00201 The policy 1 1 3 may also conduct a search of the content of the document 1 40 to determine the requ^ed 
protection level. The search could be, for example, a keyword search or a keyphrase search of the document 40. The 
protection requirements of the document 140 could be dependent on the number of occurrences of vanous ones of 
the keywords or keyphrases. 


3 


EP 1 209 897 A2 


10 


[0021] The policy 113 detennines the security requirements for the document 140 to be printed For example the 
policy 113 may determine that the document 140 to be printed requires protection against forgery by copying using a 
standard photocopier. Alternatively, the policy 1 1 3 may determine that the document 40 to be printed requires protection 
against scanning, image processing, and alteration of the contents of the document 1 40. Once the policy 1 1 3 deteimines 
the secunty requirements, the print management system 1 1 2 identifies the specific combination of protection techniques 
needed to meet these requirements. The print management system 112 then routes the print job to one of the tmsted 
printers 131-135 that can apply the appropriate protections and sets the parameters in the selected printer to apply 
he appropriate protection techniques to the document 140. Examples of the protection levels that can be applied to 
the document 1 40 when it is printed, the forgery techniques that the protection levels protect against and the equ ipment 
necessary for creating the protection level and verifying the authenticity of a document are described in Table 1 . 

Table 1 


Protection 
Levels 

Technique(s) 

Protects Against 

Equipment Needed 

Level 0 

Fragile variable copy evident 
watermark. 

Adversary with standard 
copier and toner or ink. Blank 
originals attack. 

Standard color printer, or 
special toner or ink, or 
hyperacuity printer with 
inspector. 

Level 1 

Robust variable invisible 
copy evident watennark with 
tracing information. 

Adversary who can remove 
copy evident watemnarks 
from originals. 
Blank originals attack. 
Compromised tracing attack. 

Standard color printer with 
special toner or ink. 

Level 2 

Fragile variable fluorescing 
invisible copy evident 
watermark to print page 
offset, with tracing 
information. 

Weak protection against 
tampering. 

Blank originals attack. 

Special toner or ink and 
standard highlight or color 
printer. Enhancements could 
include toner sensor or 
sensor to verify the presence 
of the copy-evident 
watermark. Fluorescent light 
to verify. 

Level 3 

Fragile variable fluorescing 
invisible copy evident 
watermark to print page 
offset, with tracing 

informstinn HinitftlK/ cinn^iH 
II 1 p 1 1 iciLiwi 1 , uiyiidiiy olun6Q 

and glyph encoded. 

Adversary who can scan, 
image process, and print and 
who has access to the special 
toner or ink. 

Special toner or ink and 
standard highlight or color 
printer. Enhancements could 
include toner sensor or 
sensor to verify the presence 
of the copy evident 
watemnark. Fluorescent light 
and fluorescent scanner to 
verify. 

Level 4 

Fragile variable fluorescing 
invisible copy evident 
watermark to print random 
portions of the page, with 
tracing information, digitally 
signed and glyph encoded. 

Adversary who can scan, 
image process, and print and 
who has the special toner or 
Ink. 

Special toner or ink and 
standard highlight or color 
printer. Enhancements could 
include toner sensor or 
sensors to verify the 
presence of the copy evident 
watermark. Fluorescent light 
and fluorescent scanner to 
verify. 

Level 5 

Robust variable fluorescing 
black copy evident 
watermark with tracing 
information. 

Adversary with standard 
copier and toner or ink. 
Compromised tracing attack. 

Fluorescing black toner or ink 
in a standard highlight or 
colorprinter. Fluorescent light 
to verify. 
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Protection 
Levels 

Technique(s) 

Protects Against 

Equipment Needed 

Level 6 

Robust variable fluorescing 
black copy evident 
watermark with tracing 
information to print fixed 
portions of the page. 

Adversary with standard 
copier and tone or ink. 
Detached toner attack. Blank 
originals attack. 

Fluorescing black toner or ink 
in a standard highlight or 
colorprinter. Fluorescent light 
to verify. 

Level 7 

Robust variable fluorescing 
black copy evident 
watermark to print random 
portions of the page, with the 
random pattern specification 
encrypted and glyph encoded 

Adversary with standard 
copier and toner or ink. 
Adversary with a scanner and 
image processor. Detached 
toner attack. Compromised 
tracing attack. 

Fluorescing black toner or ink 
in a standard highlight or 
colorprinter. Fluorescent tight 
to verify. Inspector to read 
and verify the glyph. 

Level 8 

Robust variable fluorescing 
black copy evident 
watermark to print content 
dependent portions of the 
page, with tracing 
information, encrypted and 
glyph encoded 

Adversary who alters tracing 
infonnation. Adversary with 
standard copier and ink. 
Adversary who can scan and 
image process. Detached 
toner or ink attack. 
Compromised tracing attack. 

Fluorescing black toner in a 
standard highlight or color 
printer. Fluorescent light to 
verify. Inspector to read and 
verify the glyph. 


[0022] Although Table 1 shows various watermarking techniques usable either alone or In combination to provide a 
specifled level of protection to a document, it should be appreciated that the table is merely one exemplary embodiment 
of a policy 1 1 3 Other combinations of watemnarking techniques may be provided to enable a greater range of protection 
levels The protection levels, the techniques, the forgery methods that are protected against, and the equipment nec- 
essary to apply the techniques to a document to be printed and verify if a printed document is an original or a forgeiy 

are described below. . j ■ , 

[0023] As shown In Fig. 1 , the trusted printer 1 31 can print documents having Level 0 protection, the trusted pnnter 
132 can print documents requiring Level 1 protection, the trusted printer 133 can print documents requinng Level 0 
through Level 4 protection, the trusted printer 134 can print documents requiring Level 4 through Level 8 protection 
and the trusted printer 135 can print documents requiring Level 7 and Level 8 protection. 

[00241 Fig 2 is a flowchart of one exemplary embodiment of a document forgery protection printing method according 
to this invention Beginning in step SI 000, control continues to step S1100, where a user creates a document that 
requires forgery protection. Then, in step S1200, the user enters a print command to print the document requiring 
forgeiy protection. Next, in Step S1300, information about the protection levels is displayed to the user. Control then 
continues to step SI 400. . , -ri, 

[0025] In Step SI 400, information is collected about the value of the document requiring forgery protection. The 
infomiation may include information orassumptionsaboutpotentialforgery of the document requiring forgery protection 
and the cost of applying the various available protection techniques to the document requiring forgery protection. Next, 
in step 81 500 the protection requirements of the document requiring forgery protection are determined based on a 
trusted printing policy. The determined protection requirements for the document requiring forgeiy protection may in- 
dicate that this document requires protection against forgery from copying using a standard photocopier or that the 
document requiring forgery protection requires protection against forgery by scanning, image processing and altering 
of the contents of the document. Then, in step S1600, the protection level that provides the specific combination of 
protection techniques to meet the determined protection requirements is detemiined. Control then continues to step 

fooS] In step SI 700, a trusted printer that can apply the appropriate protection techniques to the document requiring 
forqery protection is selected based on the detemnined protection level. Then, In step SI 800, the print job for the 
document requiring forgery protection is routed to the selected trusted printer Next, in step SI 900, the parameters ,n 
the selected trusted printer are set based on the determined protection level. In step S2000, the document requinng 
forgeiy protection, including the protection techniques of the determined protection level, is printed using the selected 
trusted printer. Then in step S21 00 the method ends. 

[0027] Although one exemplary embodiment of a document forger/ protection printing method according to this 
invention has been described above with respect to Fig. 2, it should be appreciated that other exemplary embodiments 
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of document forgery protection printing methods may be apparent to those of ordinary skill in the art. For example in 
various exemplary embodiments of the document forgery protection printing method according to this invention the 
information about the protection levels may be displayed prior to the print command being entered In other various 
exemplary embodiments of the document forgery protection printing method invention of this invention, the information 
about the value of the document and the potential forgery of the document may also be collected prior to the print 
command being entered In other various exemplary embodiments of the document forgery protection printing method 
according of this invention, the parameters of the selected trusted printer may be set prior to the print job being routed 
to the selected trusted printer. 

[0028] As shown in Fig. 1 , the trusted printers 131 and 133 can print documents having Level 0 protection. As shown 
in Table 1 , Level 0 protection Includes a fragile variable copy evident watermark. As shown In Fig. 3, the content owner 
who may be anyone authorized to create the document 140, view the document 140, and/or print the document 14o' 
provides image data from an image data source, which may be one of the computers 121-123 or an external data 
storage device, to an image processor, which may be an application stored on the server 1 1 0, to create the document 
1 40. Copy evidence is also provided to the image processor and included with the contents of the document 1 40 The 
copy evidence included in the document 1 40 can vary with the page of the document 140 and could include information 
Identifying the contents of the page, the page number or identifier, the author, the document title the date the time 
and the originating organization. The copy evidence could also include characteristics about the trusted printer 1 31 or 
133 or a unique copy number recorded by the trusted printer 131 or 131 . The copy evidence may be provided by the 
content owner through a graphical user interface provided on one of the display units 151-153 of one of the respective 
computers 121-123, or may be detemiined automatically by the operating system 111 . the print management system 
112, and/or the policy 113, The copy evidence is encoded In a fragile variable copy evident watermark. Because the 
copy evidence varies with each page of the document, the fragile variable copy evident watemiark varies with each 
page. 

[0029] The fragile variable copy evident watemiark of Level 0 may be formed by any known technique for forming 
ragile watermarks. Techniques for forming fragile watemnarks include, for example, microvariations in ink density within 
the letters, extremely small glyphs contained in the letters, very small marks or textures, possibly in color that are 
printed on the background or one or more unused portions of the sheet of recording material that the document Is 
printed on that are made to appear as shading or fibers in the sheet of recording material, hyperacuity pixels within 
characters of text, and serpentones within color or black and white images. 

[0030] If the policy 1 13 detemiines that the security requirements for the document 140 to be printed require a fragile 
variable copy evident watermark, the print management system 112 routes the print job to either trusted printerlSI or 
133. The pnnt management system 112 also sets the parameters in the trusted printer 131 or 133 to print the fragile 
vanable copy evident watermark. 

[0031] The fragile variable copy evident watemiark may be made more difficult to forge by encoding the copy evidence 
in the fragile variable copy evident watermark so that the information can only be decoded by a secret key contained 
m the trusted printer 131 or 1 33 or belonging to the content owner. The copy evidence contained in the fragile variable 
copy evident watemiari< may also depend on unique physical characteristics of the trusted printer 131 or 133 For 
example, a random pattern may be applied to the document by the trusted printer 31 or 33 as disclosed in U S ApdII- 
cation Serial No.09/504,036. Copy evidence unknown to an adversary, such as a forger, could also be encoded in the 
ragile variable copy evident watemiark or the fragile variable copy evident watermark could be printed using methods 
that are difficult or very expensive to reproduce such as, for example, spectral modulation 

[00321 As shown in Table 1, the trusted printer 131 or 133 may be a standard color printer or a standard printer 
provided with special toner or ink, such as, for example, fluorescing or magnetic toner or ink. The trusted printer 131 
or 133 may also be a hyperacuity printer that can print serpentones. An inspector device may be used to verify the 
presence of the serpentones, or the presence of the special toner or ink. The inspector device can also read the 
contents of the fragile variable copy watermari<. Such printers and inspector devices are disclosed in US-A-5 706 099 
and US-A-5,71 0,636. 

[0033] As shown in Fig. 3, the trusted printer 1 31 or 1 33 prints the document 1 40 on standard paper. Standard paper 
IS paper that does not necessarily have a preprinted watermark. As shown in Fig. 3, a document 140 printed with the 
fragile vanable copy evident watemiark of Level 0 is protected against an adversary having access to the original 
printed document and a standard photocopier with standard toner or ink. A visual inspector can verify if a document 
IS an onginal or a forgery. The visual inspector may be any person authorized to inspect documents for authenticity A 
document is verified as an original by the undistorted appearance of the fragile variable copy evident mark A document 
IS established as a forgery by the absence, or the discolored appearance, of the fragile variable copy evident mark 
Depending on the technology used to generate the copy evident watemiark, the Inspector device may be required to 
verify the presence of, and read the contents of, the copy evident watermark. 

[0034J As shown in Fig. 3, because the copy evidence in the fragile copy evident watermark of Level 0 varies with 
the page pnnted, Level 0 also protects against a blank originals attack. A blank originals attack is attempted forgery 
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bv copying of the original document on blank originals. Blank originals are sheets of recording material contai-iing a 
preprinted fragile watemiark However, the preprinted fragile watermark of the blank originals does not vary with the 
page printed. Thus, the presence of the non-varying preprinted fragile watermark can be detected by the visual inspec- 
tor Detecting of a non-varying fragile watemiark establishes a document as a forgery. 
5 r0035] As shown in Fig. 1 , trusted printers 132 or 133 can print documents having Level 1 protection. As shown in 
Table 1 Level 1 protection includes a robust invisible variable copy evident watermark with tracing infomnation. The 
robust invisible variable copy evident watermark may be formed by any known or later developed technique for forming 
robust watermarks. Techniques for fomiing robust watemiarks include, for example, slightvertica translations of letters 
with respect to a baseline, slight variations of spacing between letters, line indents, margins, and/or line spacings. The 
10 robust watermarks may also be fomned by adding luminance or gray-scale noise-Uke patterns. 

r00361 The robust invisible variable copy evident watemiark of Level 1 can be used to encode the copy evidence 
and the tracing information. The copy evidence included in the document 140 can vary with the page of the document 
140 and could include information identifying the content of the page, the page number or identi ier, the author the 
document title, the date, the time, and the originating organization. The copy evidence could also include characteristics 
15 about the trusted printer 132 or 133 or a unique copy number recorded by the trusted printer 132 or 133. The copy 
evidence can also include a large banner that prominent^, displays a warning statement, such as, for example, Th^ 
is a copy" or some similar warning. The tracing inf omiatlon may include, for example, information identifying to whom 
the original document was given, who is authorized to possess the document, and information relating to copy restric- 
tions or other restrictions as to the use of the Infomiation in the document. The tracing infomiation can be speci led in 
Digital Property Rights Language. The copy evidence and tracing information are encoded in the robust invisible var- 
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r00371 As shown in Fig. 4, the content owner provides image data from an image data source, which may be one of 
the computers 1 21 -123 or an external data storage device, to an image processor, which may be an application stored 
on the server 110, to create the document 140. Copy evidence and tracing information is also provided to the image 
25 processor and included with the contents of the document 1 40. During image processing of the document 1 40, the 
copy evidence and the tracing infomiation are included in the contents of the document 140. The copy evidence and 
the tracing infomiation included in the document 140 may be entered by the content owner through a graphical user 
interface provided on one of the display units 151-153 of one of the respective computers 121-123, or may be deter- 
mined automatically by the operating system 111 , the print management system 112, and/or the PO^CV JIS. 
r00381 The print management system 112 routes the print job to the trusted printer 132 or 133 and the document is 
printed on standard paper. As shown in Fig. 4, Level 1 provides protection against an adversary who has access to 
the original document 140 and a standard photocopier and standard paper and toner or ink. If the adversary copies 
the original document 140 on the standard photocopier using standard toner or Ink and standard papen a visual in- 
spector can establish the resulting copy as a forgery by noting the clearly visible appearance of the robust vanable 
copy evidentwatermarkonthe resulting copy. If a document appears to lack the robustvariablecopy evidentwatermark, 
this is evidence that the document may be an original, but a second tier inspection is required. 
[0039] As shown in Fig. 4, the second tier inspection can determine if a document is an original. The document is 
copied on a standard copier using standard paper, If the resulting copy contains a clearly visible watemiark, the onginal 
document can be verified as an original. 
40 [00401 As shown in Table 1 , Level 1 provides protection against an adversary that can remove the robust vanable 
copy evident watemiark by, for example, scanning the document and removing or deleting the watermark dunng image 
processing As shown in Table 1 and Fig. 4, Level 1 also provides protection against blank onginals attacks. Level 1 
also protects against a compromised tracing attack, where the adversary intercepts or tampers with the source of the 
tracing infomiation. The trusted printer 132 or 133 may be an standard color printer provided that may use special 
45 tonerorinkincludlng, for example, fluorescing toner or ink. •„ -r^hi^ 

[00411 As shown in Fig. 1 . the trusted printer 1 33 can print documents having Level 2 protection. As shown in Table 
1 Level 2 protection includes a fragile variable fluorescing invisible copy evident watemiark with tracing information. 
The copy evidence may Include the text of the page offset by some distance, but in any event depends on the conten s 
of the page The copy evidence and the tracing information may be encoded in the fragile variable fluorescing invisible 
50 copy evident watermark. As shown in Fig. 5, the document, including the contents, the copy evidence and tracing 
infomiation, is printed by the trusted printer 133 on standard paper using a special toner or '"k^The spec.a toner o 
ink is invisible fluorescing toner or ink. As shown in Table 1 , the trusted printer 1 33 can be a standard high ight or colo 
printer that is supplied with the fluorescing invisible toner or ink. A sensor on the output of the pnnter could verrfy that 
the copy-evident mark is properly printed. 
55 [00421 The variable nature of the copy-evident mark prevents a blank originals attack where the adve^ary pre- 
processes the paper by putting the special marks on it. The identifying information also allows for tracing the source 
of the unauthorized copy action. That is, the underlying information identifies who had custody over the original and 
should have been protecting it. The Level 2 protection might also be used to give some protection against an adversary 
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[0043] As shown in Table 1 and in Fig. 5, Level 2 provides protection against an adversary who has access to the 
ong nal document and a standard photocopier with standard toner or ink. A document can be verified as an original 
by .iiumma ing that document with fluorescence-exciting light. If the document contains a watermark that fluoresces 
under the fluorescence-exciting light and that matches the visible contents of the page, the document can be verified 

under fluo escence-excting light, or If the document contains a watemiark that fluoresces but does not match the 
visible contents of the page, the document can be established as a copy. 

!° ifir -Tnr^T ■ J ■ '""T"'^" f""'"'"' ' P^'"' "'"'^"'"""'^ '^^^'"S Level 3 protection. As shown in Table 
ThL r t ^ ^ "^^"^ ''^^'"^ fluorescing invisible copy evident watermark with tracing information 

i^ir J ! ^ P"'*''" '^"^ °' P'^e offset to the right by some distance and printed using 

invisible fluorescing toner. Tracing information such as printer, user, timestamp, document-Id, and page number is also 

a^oh "Z' Tr : T- ^^'-^^"^ -9-^^ and encoded!mo 

a glyph code that IS printed in the left margin of the page. 

[0045] As shown in Table 1 and Fig. 6, Level 3 provides protection against an adversary who can scan image process 
and print, and thus attempt to tamper with the content of the document, and who has access to the spSl in used 
Protection against a naive attacker is via a fluorescent detector as in Level 2 protection. Additional tamper protection 
and authenticity IS provided by the digital signature encoded In the glyph code 

[0046] Special inks and an ordinary highlight printer or an ordinary color printer can be used to print the original 
?ddZ" f • ^'"''''"'''^ '° '^^ -'^l^^- sensors to Check that fluorescent toner Is loaded and used 

A ' '""T V : °' P'"'"' """"^ '° t*^^ '^a^k is properly printed 

1 Z hT^ ? '° ''^ '^"Py '^^'^ a light scanSer can 

rnn^^f I t 'nformation pnnted in fluorescent ink. This method is backward compatible with Level 2 protection 

m!rk i«, r".'r t ^ "^^^ ^" P^^^^"<=^ of a fluorescem copyevident 

Zhrni f H )"-b>e contents of the page or by successful verification of the digital signature encoded in the 

glyphcode.Adocumentmaybever.fiedasacopybytheabsenceofthefluorescentcopyev^ 

SeSed ""^^ "^''"^'^ ^ ''°P>' ^'9**^' "'9"^'"'^ ^a""°' successfully 

S i'^? '"T." ^ ■ '''^ ''"''^'^ P""'^'' ^""^ ' P^'"* documents having Level 4 protection. As shown 
oenSld Ztt " T 'T'"'^' ^ """^''^ """^^^'^'"g copy evident watermark to print randomly 

generated patterns Tracing information is also included in the copy evident watemnari<. The random pattern of the 
copy evident mark « digitally signed and encoded into a glyph code that is printed on the page 
[0049] As shown in Fig. 7, Level 4 provides protection against an adversary who has access to a scanner image 
processing software, and a color printer, as well as access to the special ink used, and who may attempt to use these 
to tamper with the content of the document or to forge an acceptable copy evident mark. Addftional tamper proteSon 
and authenticity IS provided by the digital signature encoded in the glyph code 

[0050] Special inks and an ordinary highlight printer or ordinary color printer can be used to print the original docu- 
Zlt ^"""^""l '° '""^ P""'^' '^""'d include sensors to check that fluorescent toner is loaded and used. Addi- 

T.TllT"V" T^"' °' P™'"^ '° '''^^ P^"^"^ P^°P«^ly Printed. A fluorescent 

,ght source can be used to expose the copy evident mark. A fluorescence-exciting light scanner can be used to read 
the information printed in the fluorescent ink. useu lo reaa 

(0051] As shown in Fig. 7. a document may be verified as an original if the fluorescent pattern measured from the 
papermatchesthepatternencoded in the glyph codeorby successful vermcation of thedigitals 

rnay be verified asacopybytheabsenceofthefluorescent copy evldentwatermark.lfthecopyevidentmark is present 
the document may still be verified as a copy if the fluorescent pattern measured from the paper fails to mE tie 

ceS,;Sifd.'" " "'''^ ' ^°P^ ^'9i.al Signature cannott sue 

[0052] As shown In Fig, 1 , the trusted printer 1 34 can print documents having Level 5 protection. As shown in Table 

in the mark. As shown in Fig. 8. Level 5 provides protection against an adversary who uses a standard copier to make 
an unauthonzed copy or attempted forgery, and who does not have access to the fluorescing ink The equipmenUha' 
can be used to enable Level 5 protection is fluorescing black toner in an ordinary highlight or color prin e A fl es 
cence-exciting light source can aid in the verification of the copy evident watemiark 

fSn- iTT^"^ ""^^ "^''"^'^ ^" ^''"^"y '"^P^^t'^g the document. Visual inspection reveals the 

or Hon? k^^°PV ^^'^^"t "^^^k A document may be verified as a copy by the absence of the copy evident mark 

or a copy evident mark printed in ordinary ink. ^viueiii mcirh., 

[0054] As shown in Fig. 1 , the trusted printer 134 can print documents having Level 6 protection. As shown in Table 
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1 copy evidence is provided by the use of a robust fluorescing black copy evident mark. For example, such as mark 
could be created by printing fluorescing Invisible ink over ordinary black ink. The fluorescent black ink is used to print 
fixed portions of the document contents (the portion selected to be printed in this way does not depend on the document 
contents) Tracing Information can also be encoded in the mark. As shown in Fig, 9, Level 6 provides protection against 
5 an adversary who uses a plain copier to make an unauthorized copy or attempted forgery and who does not have 
access to the special ink. Level 6 also protects against an adversary with physical access to the tmsted pnnter that 
detaches the fluorescing toner, since this would cause portions of the printed page to disappear. 
[0055] The equipment that can be used to provide Level 6 protection includes fluorescing black toner or ink in an 
ordinary highlight or color printer or a combination of fluorescing Invisible ink and ordinary black ink. A special viewer 
to can be used to detect and verify the correct pattern of the copy evident watermark. 

[00561 As shown in Fig. 9, a document may be verified as an original by visually inspecting the document to verify 
that the entire contents of the document page have been printed. A special viewer may be used to verify that part of 
the visible contents of the document fluoresces or to verify the correct fluorescent pattern. A document may be venf led 
as a copy by visually inspecting the document. If a portion of the page has not been printed, the document can be 
verified as a copy. If the entire page has been printed, the document may be verified as a copy by the absence of the 
fluorescing black copy evident marie, or by the existence of a non-fluorescing copy evident mark. A document may be 
verified as a copy if the special viewer reveals an incorrect fluorescing pattern in the copy evident mark. 
[0057] As shown in Fig. 1 , the trusted printers 134 and 1 35 can print documents having Level 7 protection. As shown 
in Table 1 Level 7 protection Includes a robust fluorescent black variable copy evident watemiark. As shown in Fig. 
1 0 the fluorescent black toner or ink is used to print randomly selected portions of the content of the document. The 
information about which pattern is used is encrypted and encoded as a glyph code that is printed on the document 
using a key that Is known to the trusted printers 134 and 135 and to an inspector device. The inspector device can 
read the glyph code, decode the glyph code to get the encrypted pattern infonnation, and decrypt the pattern informa- 
tion The copy evidence and the tracing information are also encoded in the watermark. 
25 [0058] As shown in Fig . 1 0, Level 7 provides protection against an adversary that has access to an original document 
and the trusted printer 1 34 or 1 35 but does not have access to the fluorescent black toner or ink. Level 7 also protects 
against an attacker with physical access to the trusted printer that detaches the fluorescing toner, since this would 
cause portions of the printed page to disappear. Level 7 also protects against an attacker who has a scanner and an 

30 [S^'veXation of a document as an original can be done using fluorescence-exciting light. If portions of the 
document fluoresces when exposed to fluorescence-exciting light, this Is evidence that the document may be an ong- 
inal A second tier inspection is necessary. The inspector device verifies that the decrypted glyph-encoded information 
matches the fluorescent pattern. If portions of the document are missing, the document can be verified as a copy. If 
the entire document is printed but has no watermark or a black watemiark that does not fluoresce, the document can 

35 be established as a copy. If the document has fluorescent portions but the decrypted glyph encoded information does 
not match the fluorescent pattern, the document can be established as a copy. If the decoded, decrypted pattern 
Information matches the detected pattern, the document can be verified as an original. 

[0060] The trusted printers 134 and 135 can be standard highlight or color printers provided with fluorescent black 

40 [00611 As shown in Fig. 1 . the trusted printers 134 and 135 can print documents having Level 8 protection. As shown 
in Table 1 Level 8 protection includes a robust fluorescing black variable copy evident watermark to print content 
dependeni portions of the document, with tracing Infomnation that is encrypted given a key known to the pnnter and to 
the inspector device and glyph encoded. The watermari< includes selected portions of the document's contents that 
are printed In fluorescing black toner or ink. The selected portions are selected as a function of the document's content^ 

45 Information about the user and about the trusted printer 1 34 or 1 35 and the fluorescing pattern are encrypted and 
encoded In a glyph code that is printed on the document. . . 

[00621 As shown in Table 1 , Level 8 provides protection against an adversary that has access to the original document 
and a standard copier and standard toner or ink. As shown in Fig. 11 , Level 8 also protects against an adversary that 
has access to the original document, a scanner, an image processor and the trusted printer 1 34 or 1 35 and who tries 

50 to alter the tracing information. Even if the attacker tries to alter the tracing infomiation, the attacker doesn t know the 
key to encrypt or decrypt the tracing infomiation. Level 8 also protects against a detached toner attack, since this would 
cause portions of the printed page to disappear. 

[00631 Establishing a document as a copy can also be done by a visual inspection. If portions of the printed documerit 
are missing, the document can be established as a copy. If the entire document is printed but has no visible watermark 
55 or a visible watermark that does not fluoresce, the document can be established as a copy. A second tier inspection 
determines if the pattern information that is decoded and decryptedf rom the glyph code by the inspector device matches 
the fluorescent pattern detected by a fluorescent light scanner. If the decoded, deciypted pattern information matches 
the detected pattern, the document can be verified as an original. 
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[0064] The trusted printers 134 and 135 can be standard highlight or color printers provided with fluorescent black 
oner. A fluorescent light scanner can be used to detect the fluorescent pattern and an inspector device can be used 
o read the glyph, decode the glyph to get the encrypted pattern information, decrypt the pattern information and match 

the pattern information against the detected fluorescent pattern. 

[0065] Various aspects of the present invention are described In the following numbered clauses:- 
1. A document forgery protection printing method comprising: 
processing an Image of a document; 

determining forgery protection requirements for the document to be printed; 

determining a protection level to be applied to the document based on the determined forgery protection re- 
quirements; 

selecting a printer from a plurality of printers that can print the document; and 

based on the determined protection level, printing at least one watermark on the document that corresponds 
to the detennined protection level using the selected printer. 

2 Jhe method of clause 1 , wherein detemiining the forgery protection requirements includes displaying information 
about forgery techniques. 

3. The method of clause 2, wherein displaying information further includes displaying information about forqery 
techniques each protection level is able to at least one of detect and deter. 

4 The method of clause 1 , wherein determining the forgery protection requirements Includes collecting Infomiation 
about the document. 

5 The method of clause 1 , wherein detemiining the protection level includes identifying at least one of a creator 
of the document, a person entering a command to print the document, and an image processor that processes 
the image of the document. 

6. The method of clause 1 . wherein determining the protection level includes reviewing contents of the document 

7. The method of clause 1. further comprising querying the plurality of printers to determine the protection level 
each printer can apply to the document. 

8. The method of clause 1 . further comprising setting printing parameters on the selected printer to apply the 
detennined protection level to the document. 

a The method of clause 1 . wherein determining the protection level includes at least one of assigning and selectinq 
the protection level by at least one of a creator of the document and a person entering a command to print the 
document. 

10. A document forgery protection printing system, comprising: 

at least one server having a print management system and a policy that determines a forgery protection level 
for the document; 

at least one image processor that processes an image of the document; 

a plurality of printers, each printer able to print the document and able to apply at least one protection level to 
the document by pnnting at least one watermark on the document that corresponds to the determined orotec- 
tion level. 

1 1 . The document forgery protection printing system of clause 1 0, further comprising a display device at least one 
of the server and one of the at least one image processors driving the display device to display information about 
forgery techniques. 

12. The document forgery protection printing system of clause 11, wherein the displayed Infonnation includes 
information about forgeiy techniques each protection level is able to at lest one of detect and deter 

13. The document forgery protection printing system of clause 10, wherein the policy determines the protection 
level for the document based on infomiation collected from at least one of a creator of the document and a person 
entenng a command to print the document. 

14. The document forgery protection printing system of clause 10, wherein the policy determines the protection 
level based on at least one of a creator of the document, a person entering a command to print the document and 
an image processor that processes the image of the document. 

15. The document forgery protection printing system of clause 10, wherein the policy detennlnes the protection 
level based on contents of the document. 

16. The document forgery protection printing system of clause 10, wherein the policy determines the protection 
level based at least in part on a protection level assigned to the document. 

1 7. The document forgery protection printing system of clause 1 0, wherein the server sets printing parameters for 
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the selected printer selected to apply the determined protection level to the document. 


Claims 

1 . A document forgery protection printing method comprising: 


processing an image of a document; 

determining forgery protection requirements for the document to be printed; 

determining a protection level to be applied to the document based on the determined forge^^ protection re- 
quirements; 

selecting a printer from a pluraiity of printers ttiat can print tfie document; and 

based on the delemiined protection level, printing at least one watermark on the document that corresponds 
to the determined protection level using the selected printer. 

2. A document forgery protection printing system, comprising: 

at least one image processor that processes an image of document including at least one page; 

at least one server having a print management system and a policy that detemiines a forgery protection level 

l°pluTanw oTprinters, each printer able to print the document and able to apply at lest one protection level to 
the document by printing at least one watermark including copy evidence and tracing infomialion on the doc- 
ument that corresponds to the detemnined protection level. 

3. A method orsystem according to claim 1 or 2, wherein the copy evidence and/orthe tracing Infomiation is encoded 

in the watemnark. 

4. A method or system according to any preceding claim, wherein the copy evidence varies with each page of the 
document. 

5 A method or system according to any one of the preceding claims, wherein the watermark comprises the contents 
of each page printed using invisible fluorescing toner or ink and offset from the visible contents of each page, 

6 A method or system according to any one of the preceding claims, wherein the tracing infomiation is digitally signed 
■ and encoded in a glyph and printed using invisible fluorescing toner or Ink and located in a margin of each page. 

7. A method or system according to any one of the preceding claims, wherein the watemnark comprises random 
generated patterns printed using Invisible fluorescing toner or ink. 

8. A method or system according to any one of the preceding claims, wherein the watemiark is printed using fluo- 
rescing black toner or ink. 

9 A method or system according to claim 8, wherein the watermark comprises fixed portions or random portions of 
each page or content dependent portions of each page printed using the fluorescing black toner or ink. 

10. A method or system according to claim 7 or 9, wherein the randomly generated patterns or random portions of 
each page are encoded in a glyph and preferably digitally signed. 
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